chore(deps): update module github.com/golang-jwt/jwt/v4 to v5

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/golang-jwt/jwt/v4	v4.5.2 → v5.3.1

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

golang-jwt/jwt (github.com/golang-jwt/jwt/v4)

v5.3.1

Compare Source

What's Changed

🔐 Features

• Add spellcheck Github action to catch common spelling mistakes by @​equalsgibson in #​458
• Add WithNotBeforeRequired parser option and add test coverage by @​equalsgibson in #​456
• Update godoc example func to properly refer to NewWithClaims() by @​equalsgibson in #​459
• Update github workflows by @​mfridman in #​462
• Additional test for CustomClaims that validates unmarshalling behaviour by @​equalsgibson in #​457
• Fix early file close in jwt cli by @​mfridman in #​472
• Add TPM signature reference by @​salrashid123 in #​473
• Remove misleading ParserOptions documentation in #​484
• Save signature to Token struct after successful signing by @​EgorSheff in #​417
• Set token.Signature in ParseUnverified by @​slickwilli in #​414

👒 Dependencies

• Bump crate-ci/typos from 1.34.0 to 1.35.3 by @​dependabot[bot] in #​461
• Bump crate-ci/typos from 1.35.4 to 1.36.2 by @​dependabot[bot] in #​470
• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​478
• Bump crate-ci/typos from 1.36.2 to 1.39.0 by @​dependabot[bot] in #​480
• Bump golangci/golangci-lint-action from 8 to 9 by @​dependabot[bot] in #​481
• Bump actions/setup-go from 5 to 6 by @​dependabot[bot] in #​469
• Bump crate-ci/typos from 1.39.0 to 1.40.0 by @​dependabot[bot] in #​488
• Bump actions/checkout from 5 to 6 by @​dependabot[bot] in #​487
• Bump crate-ci/typos from 1.40.0 to 1.41.0 by @​dependabot[bot] in #​490
• Bump crate-ci/typos from 1.41.0 to 1.42.1 by @​dependabot[bot] in #​492

New Contributors

• @​equalsgibson made their first contribution in #​458
• @​salrashid123 made their first contribution in #​473
• @​EgorSheff made their first contribution in #​417
• @​slickwilli made their first contribution in #​414

Full Changelog: golang-jwt/jwt@v5.3.0...v5.3.1

v5.3.0

Compare Source

This release is almost identical to to v5.2.3 but now correctly indicates Go 1.21 as minimum requirement.

What's Changed

• Create CODEOWNERS by @​oxisto in #​449
• Bump Go version to indicate correct minimum requirement by @​oxisto in #​452

Full Changelog: golang-jwt/jwt@v5.2.3...v5.3.0

v5.2.3

Compare Source

What's Changed

• Bump GitHub workflows and Go versions by @​mfridman in #​438
• Implementing validation of multiple audiences by @​oxisto in #​433
• Bump golangci/golangci-lint-action from 7 to 8 by @​dependabot[bot] in #​440
• replaced interface{} to any by @​aachex in #​445
• Fix bug in validation of multiple audiences by @​sfinnman-cotn in #​441

New Contributors

• @​aachex made their first contribution in #​445
• @​sfinnman-cotn made their first contribution in #​441

Full Changelog: golang-jwt/jwt@v5.2.2...v5.2.3

v5.2.2

Compare Source

What's Changed

• Fixed GHSA-mh63-6h87-95cp by @​mfridman
• Fixed some typos by @​Ashikpaul in #​382
• build: add go1.22 to ci workflows by @​mfridman in #​383
• Bump golangci/golangci-lint-action from 4 to 5 by @​dependabot in #​387
• Bump golangci/golangci-lint-action from 5 to 6 by @​dependabot in #​389
• chore: bump ci tests to include go1.23 by @​mfridman in #​405
• Fix jwt -show by @​AlexanderYastrebov in #​406
• docs: typo by @​kvii in #​407
• Update SECURITY.md by @​oxisto in #​416
• Update jwt.Parse example to use jwt.WithValidMethods by @​mattt in #​425

New Contributors

• @​Ashikpaul made their first contribution in #​382
• @​kvii made their first contribution in #​407
• @​mattt made their first contribution in #​425

Full Changelog: golang-jwt/jwt@v5.2.1...v5.2.2

v5.2.1

Compare Source

What's Changed

• chore: remove unnecessary conversions from tests by @​estensen in #​370
• Trivial: Typo fix for ECDSA error message by @​tjs-cinemo in #​373
• Fix incorrect error return by @​ss49919201 in #​371

New Contributors

• @​tjs-cinemo made their first contribution in #​373
• @​ss49919201 made their first contribution in #​371

Full Changelog: golang-jwt/jwt@v5.2.0...v5.2.1

v5.2.0

Compare Source

What's Changed

• Exported NewValidator by @​oxisto in #​349
• Improve ErrInvalidKeyType error messages by @​Laurin-Notemann in #​361
• Update MIGRATION_GUIDE.md by @​jbarham in #​363

New Contributors

• @​Laurin-Notemann made their first contribution in #​361
• @​jbarham made their first contribution in #​363

Full Changelog: golang-jwt/jwt@v5.1.0...v5.2.0

v5.1.0

Compare Source

What's Changed

• Using jwt's native ErrInvalidType instead of json.UnsupportedTypeError by @​oxisto in #​316
• Fix typos in comments and test names by @​alexandear in #​317
• Format: add whitespaces, remove empty lines by @​alexandear in #​319
• Refactor example: use io.ReadAll instead of io.Copy by @​alexandear in #​320
• Refactor code by using switch instead of if-else by @​alexandear in #​318
• A quick way to validate token string by @​dcalsky in #​302
• Refactor: remove unnecessary []byte conversion to string by @​alexandear in #​330
• Refactor: compare strings with strings.EqualFold by @​alexandear in #​329
• Avoid use of json.NewDecoder by @​craigpastro in #​313
• Update ParseUnverified godoc by @​duhaesbaert in #​341
• Update ci workflows (add go1.21) by @​mfridman in #​345
• Bump actions/checkout from 3 to 4 by @​dependabot in #​346
• Key rotation with VerificationKeySet by @​mfridman in #​344
• Add explicit ClaimsValidator implementation check for custom claims by @​epelc in #​343
• feat: allow making exp claim required by @​tareksha in #​351
• Add error handling to examples by @​craigpastro in #​312

New Contributors

• @​alexandear made their first contribution in #​317
• @​dcalsky made their first contribution in #​302
• @​craigpastro made their first contribution in #​313
• @​duhaesbaert made their first contribution in #​341
• @​epelc made their first contribution in #​343
• @​tareksha made their first contribution in #​351

Full Changelog: golang-jwt/jwt@v5.0.0...v5.1.0

v5.0.0

Compare Source

🚀 New Major Version v5 🚀

It's finally here, the release you have been waiting for! We don't take breaking changes lightly, but the changes outlined below were necessary to address some of the challenges of the previous API. A big thanks for @​mfridman for all the reviews, all contributors for their commits and of course @​dgrijalva for the original code. I hope we kept some of the spirit of your original v4 branch alive in the approach we have taken here.
~@​oxisto, on behalf of @​golang-jwt/maintainers

Version v5 contains a major rework of core functionalities in the jwt-go library. This includes support for several validation options as well as a re-design of the Claims interface. Lastly, we reworked how errors work under the hood, which should provide a better overall developer experience.

Starting from v5.0.0, the import path will be:

"github.com/golang-jwt/jwt/v5"

For most users, changing the import path should suffice. However, since we intentionally changed and cleaned some of the public API, existing programs might need to be updated. The following sections describe significant changes and corresponding updates for existing programs.

Parsing and Validation Options

Under the hood, a new validator struct takes care of validating the claims. A long awaited feature has been the option to fine-tune the validation of tokens. This is now possible with several ParserOption functions that can be appended to most Parse functions, such as ParseWithClaims. The most important options and changes are:

• Added WithLeeway to support specifying the leeway that is allowed when validating time-based claims, such as exp or nbf.
• Changed default behavior to not check the iat claim. Usage of this claim is OPTIONAL according to the JWT RFC. The claim itself is also purely informational according to the RFC, so a strict validation failure is not recommended. If you want to check for sensible values in these claims, please use the WithIssuedAt parser option.
• Added WithAudience, WithSubject and WithIssuer to support checking for expected aud, sub and iss.
• Added WithStrictDecoding and WithPaddingAllowed options to allow previously global settings to enable base64 strict encoding and the parsing of base64 strings with padding. The latter is strictly speaking against the standard, but unfortunately some of the major identity providers issue some of these incorrect tokens. Both options are disabled by default.

Changes to the Claims interface

Complete Restructuring

Previously, the claims interface was satisfied with an implementation of a Valid() error function. This had several issues:

• The different claim types (struct claims, map claims, etc.) then contained similar (but not 100 % identical) code of how this validation was done. This lead to a lot of (almost) duplicate code and was hard to maintain
• It was not really semantically close to what a "claim" (or a set of claims) really is; which is a list of defined key/value pairs with a certain semantic meaning.

Since all the validation functionality is now extracted into the validator, all VerifyXXX and Valid functions have been removed from the Claims interface. Instead, the interface now represents a list of getters to retrieve values with a specific meaning. This allows us to completely decouple the validation logic with the underlying storage representation of the claim, which could be a struct, a map or even something stored in a database.

type Claims interface {
	GetExpirationTime() (*NumericDate, error)
	GetIssuedAt() (*NumericDate, error)
	GetNotBefore() (*NumericDate, error)
	GetIssuer() (string, error)
	GetSubject() (string, error)
	GetAudience() (ClaimStrings, error)
}

Supported Claim Types and Removal of StandardClaims

The two standard claim types supported by this library, MapClaims and RegisteredClaims both implement the necessary functions of this interface. The old StandardClaims struct, which has already been deprecated in v4 is now removed.

Users using custom claims, in most cases, will not experience any changes in the behavior as long as they embedded RegisteredClaims. If they created a new claim type from scratch, they now need to implemented the proper getter functions.

Migrating Application Specific Logic of the old Valid

Previously, users could override the Valid method in a custom claim, for example to extend the validation with application-specific claims. However, this was always very dangerous, since once could easily disable the standard validation and signature checking.

In order to avoid that, while still supporting the use-case, a new ClaimsValidator interface has been introduced. This interface consists of the Validate() error function. If the validator sees, that a Claims struct implements this interface, the errors returned to the Validate function will be appended to the regular standard validation. It is not possible to disable the standard validation anymore (even only by accident).

Usage examples can be found in example_test.go, to build claims structs like the following.

// MyCustomClaims includes all registered claims, plus Foo.
type MyCustomClaims struct {
	Foo string `json:"foo"`
	jwt.RegisteredClaims
}

// Validate can be used to execute additional application-specific claims
// validation.
func (m MyCustomClaims) Validate() error {
	if m.Foo != "bar" {
		return errors.New("must be foobar")
	}

	return nil
}

Changes to the Token and Parser struct

The previously global functions DecodeSegment and EncodeSegment were moved to the Parser and Token struct respectively. This will allow us in the future to configure the behavior of these two based on options supplied on the parser or the token (creation). This also removes two previously global variables and moves them to parser options WithStrictDecoding and WithPaddingAllowed.

In order to do that, we had to adjust the way signing methods work. Previously they were given a base64 encoded signature in Verify and were expected to return a base64 encoded version of the signature in Sign, both as a string. However, this made it necessary to have DecodeSegment and EncodeSegment global and was a less than perfect design because we were repeating encoding/decoding steps for all signing methods. Now, Sign and Verify operate on a decoded signature as a []byte, which feels more natural for a cryptographic operation anyway. Lastly, Parse and SignedString take care of the final encoding/decoding part.

In addition to that, we also changed the Signature field on Token from a string to []byte and this is also now populated with the decoded form. This is also more consistent, because the other parts of the JWT, mainly Header and Claims were already stored in decoded form in Token. Only the signature was stored in base64 encoded form, which was redundant with the information in the Raw field, which contains the complete token as base64.

type Token struct {
	Raw       string                 // Raw contains the raw token
	Method    SigningMethod          // Method is the signing method used or to be used
	Header    map[string]interface{} // Header is the first segment of the token in decoded form
	Claims    Claims                 // Claims is the second segment of the token in decoded form
	Signature []byte                 // Signature is the third segment of the token in decoded form
	Valid     bool                   // Valid specifies if the token is valid
}

Most (if not all) of these changes should not impact the normal usage of this library. Only users directly accessing the Signature field as well as developers of custom signing methods should be affected.

What's Changed

• Added GitHub Actions Markdown by @​oxisto in #​260
• Remove StandardClaims in favor of RegisteredClaims by @​oxisto in #​235
• Adding more coverage by @​oxisto in #​268
• More consistent way of handling validation errors by @​oxisto in #​274
• New Validation API by @​oxisto in #​236
• v5 Pre-Release by @​oxisto in #​234
• no need for string slice and call to strings.join by @​moneszarrugh in #​115
• Update MIGRATION_GUIDE.md by @​liam-verta in #​289
• Moving DecodeSegement to Parser by @​oxisto in #​278
• Adjusting the error checking example by @​oxisto in #​270
• add documentation to hmac Verify & Sign to detail why string is not an advisable input for key by @​dillonstreator in #​249
• Add golangci-lint by @​mfridman in #​279
• Added dependabot updates for GitHub actions by @​oxisto in #​298
• Bump actions/checkout from 2 to 3 by @​dependabot in #​299
• Bump actions/setup-go from 3 to 4 by @​dependabot in #​300
• Added coverage reporting by @​oxisto in #​304
• Last Documentation cleanups for v5 release by @​oxisto in #​291
• enable jwt.ParsePublicKeyFromPEM to parse PKCS1 Public Key by @​twocs in #​120

New Contributors

• @​moneszarrugh made their first contribution in #​115
• @​liam-verta made their first contribution in #​289
• @​dillonstreator made their first contribution in #​249
• @​dependabot made their first contribution in #​299
• @​twocs made their first contribution in #​120

Full Changelog: golang-jwt/jwt@v4.5.0...v5.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:46 PM UTC · Completed 10:54 PM UTC
Commit: 01f864b · View workflow run →

[fullsend-ai-review]

Review — ⚠ Changes Requested

PR: #161 — chore(deps): update module github.com/golang-jwt/jwt/v4 to v5
Author: red-hat-konflux[bot] (automated)
Scope: go.mod only (1 file, 1 line changed)

---

Summary

This PR attempts to update the indirect dependency github.com/golang-jwt/jwt from v4.5.2 to v5.3.1. The change is build-breaking — CI checks ("Lint Go Code" and "Run Tests") are both failing on the head commit.

Findings

1. 🔴 Missing go.sum update — build failure (high)

File: go.mod (line 78)

The PR modifies go.mod to reference github.com/golang-jwt/jwt/v5 v5.3.1 but does not update go.sum. The go.sum file still only contains checksums for jwt/v4:

github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=

Without checksums for jwt/v5, go mod download, go build, and go test all fail because the Go toolchain cannot verify the module integrity.

Remediation: Run go mod tidy after the go.mod change to regenerate go.sum with the correct checksums.

2. 🔴 Go major version change creates module path incompatibility (high)

File: go.mod (line 78)

In Go modules, major version changes create entirely different module paths. github.com/golang-jwt/jwt/v4 and github.com/golang-jwt/jwt/v5 are separate modules — they have different import paths and are resolved independently in the module graph.

The PR simply swaps the go.mod line:

-	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect

This only works if all transitive dependencies that previously required jwt/v4 have migrated to jwt/v5. If any dependency in the module graph still imports jwt/v4, removing it from go.mod breaks the dependency resolution. The correct approach is:

1. Run go get github.com/golang-jwt/jwt/v5@v5.3.1
2. Run go mod tidy to let Go resolve the full dependency graph
3. Verify no dependency still requires jwt/v4 (if one does, both modules may need to coexist)

The indirect dependency is likely pulled in by github.com/bradleyfalzon/ghinstallation/v2 v2.17.0, which in recent versions uses jwt/v5. However, this must be verified by running go mod tidy rather than manually editing go.mod.

Remediation: Use go get and go mod tidy instead of manual go.mod editing to ensure the dependency graph is consistent and go.sum is updated.

3. 🟡 Automated tooling misconfiguration (medium)

File: go.mod

The Renovate/MintMaker bot treats this as a simple version bump (v4.5.2 → v5.3.1), but in Go's module system, v4 → v5 is a major version change that alters the module path. The bot should either:

• Be configured to run go mod tidy after modifying go.mod
• Treat Go major version bumps differently from minor/patch updates
• Or skip cross-major-version updates for Go indirect dependencies

This is a recurring risk for any Go repository using automated dependency update tools that don't account for Go's module path versioning semantics.

CI Status

Check	Status
Lint Go Code	❌ failure
Run Tests	❌ failure
Konflux build	❌ failure
Validate AGENTS.md	✅ success

Recommendation

This PR should not be merged in its current state. The correct approach is:

1. Check out this branch locally
2. Run go get github.com/golang-jwt/jwt/v5@v5.3.1 (if the upgrade is desired)
3. Run go mod tidy to resolve the full dependency graph
4. Commit both go.mod and go.sum
5. Verify CI passes

Alternatively, if the upgrade isn't urgent (this is an indirect dependency with no direct security exposure in this codebase), consider closing this PR and configuring the bot to avoid cross-major-version updates for Go modules.

Previous run

Review of PR #161 — chore(deps): update module github.com/golang-jwt/jwt/v4 to v5

Verdict: ❌ Request Changes

This PR from MintMaker/Renovate attempts to update github.com/golang-jwt/jwt/v4 v4.5.2 to github.com/golang-jwt/jwt/v5 v5.3.1 by modifying a single line in go.mod. The PR is broken and CI is failing (both Lint Go Code and Run Tests jobs). Two issues must be resolved before this can merge.

Findings

1. go.sum not updated — go mod tidy was not run (high)

The PR modifies go.mod but does not update go.sum. The go.sum file still contains checksums for jwt/v4 only and has no entries for jwt/v5. This alone will cause build failures because the Go toolchain requires go.sum to be consistent with go.mod.

The project's own AGENTS.md explicitly warns: "Don't skip go mod tidy — CI will fail on inconsistent go.sum."

Remediation: Run go mod tidy after modifying go.mod and include the resulting go.sum changes in the PR.

2. Incorrect Go major version migration (high)

In Go modules, github.com/golang-jwt/jwt/v4 and github.com/golang-jwt/jwt/v5 are different modules with different import paths. This is not a simple semver version bump — it is a module replacement.

The jwt/v4 module is currently listed as // indirect, meaning it is pulled in by one or more transitive dependencies (likely through argoproj/argo-cd/v2, bradleyfalzon/ghinstallation/v2, or their dependency trees). Simply replacing the jwt/v4 line with jwt/v5 in go.mod will break the build if any transitive dependency still imports github.com/golang-jwt/jwt/v4.

The correct migration requires:

1. Identifying which transitive dependency pulls in jwt/v4 (via go mod why github.com/golang-jwt/jwt/v4 or go mod graph | grep jwt)
2. Verifying that dependency has a version available that uses jwt/v5
3. Updating that intermediate dependency first (if needed)
4. Running go mod tidy to let Go resolve the correct dependency graph
5. Confirming the build succeeds

The MintMaker/Renovate bot appears to be treating this Go major version change as an ordinary semver bump, which does not work for Go modules.

Remediation: This PR needs to be regenerated with proper Go module tooling (go get, go mod tidy) rather than a text substitution in go.mod. If the transitive dependency that requires jwt/v4 hasn't migrated to jwt/v5 yet, this update cannot be performed until it does.

Summary

#	Severity	Category	File	Description
1	high	correctness	go.mod	go.sum not updated — go mod tidy was not run; build fails
2	high	correctness	go.mod	Incorrect Go major version migration — jwt/v4 and jwt/v5 are different modules; transitive dependencies may still require jwt/v4

Both CI checks (Lint Go Code and Run Tests) are failing, confirming the PR is not buildable in its current state.

Previous run (2)

Review — request-changes

Summary

This Renovate/MintMaker PR attempts to update github.com/golang-jwt/jwt from v4.5.2 to v5.3.1 by modifying a single line in go.mod. However, this change is incomplete and will not build. Both CI jobs ("Run Tests" and "Lint Go Code") have failed, confirming the issues identified below.

Findings

1. Missing go.sum update (high)

File: go.sum

The PR modifies go.mod to reference github.com/golang-jwt/jwt/v5 v5.3.1 but does not include corresponding updates to go.sum. The go.sum file still only contains hash entries for jwt/v4:

github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+...
github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+...

Without jwt/v5 hash entries in go.sum, go mod download fails — breaking both the Dockerfile build (RUN go mod download) and CI test/lint steps.

Remediation: Run go mod tidy to regenerate both go.mod and go.sum with the correct dependency graph, then commit both files.

2. Invalid major version module substitution (high)

File: go.mod

In Go modules, github.com/golang-jwt/jwt/v4 and github.com/golang-jwt/jwt/v5 are different modules with different import paths. They cannot be substituted by simply changing the version in go.mod. If any transitive dependency (e.g., bradleyfalzon/ghinstallation/v2, argoproj/argo-cd/v2, or others) still imports jwt/v4, the build requires jwt/v4 to remain in go.mod regardless of whether jwt/v5 is also added.

The correct approach is:

1. Run go mod tidy to let Go resolve the actual dependency graph
2. If jwt/v4 is still transitively required, it cannot be removed
3. If all transitive consumers have migrated to jwt/v5, go mod tidy will naturally drop jwt/v4 and add jwt/v5

Remediation: Do not manually substitute major versions of Go modules. Run go mod tidy and commit the resulting go.mod and go.sum.

CI Status

Check	Status
Run Tests	❌ failure
Lint Go Code	❌ failure
Validate AGENTS.md line limit	✅ success

Both build-critical checks confirm this PR cannot be merged as-is.

Recommendation

This PR should be regenerated with a proper go mod tidy run. If the upstream transitive dependencies have not yet migrated to jwt/v5, this update cannot be applied at this time.

Previous run (3)

Review — PR #161

Verdict: ⛔ Request Changes

This PR attempts to upgrade the indirect dependency github.com/golang-jwt/jwt from v4.5.2 to v5.3.1 by replacing the module path in go.mod. However, this change is invalid due to Go module major version semantics and will break the build.

---

Findings

1. 🔴 Invalid major version module replacement — build break

Severity: High · File: go.mod:78

In Go modules, github.com/golang-jwt/jwt/v4 and github.com/golang-jwt/jwt/v5 are entirely separate module paths — they are not interchangeable. This PR replaces the v4 entry with v5, but at least two upstream dependencies still require jwt/v4:

• github.com/bradleyfalzon/ghinstallation/v2 v2.17.0 — directly requires github.com/golang-jwt/jwt/v4
• github.com/argoproj/argo-cd/v2 v2.14.21 — also depends on github.com/golang-jwt/jwt/v4

Removing jwt/v4 from go.mod while these transitive dependencies still import from the jwt/v4 module path makes it impossible for the Go toolchain to satisfy the dependency graph. CI confirms this: both test and lint checks are failing.

This appears to be an automated dependency bot (Renovate/Konflux) that incorrectly treated the v4-to-v5 major version change as a simple version upgrade.

Remediation: This PR should be closed. The golang-jwt/jwt/v4 module cannot be removed until all transitive consumers (ghinstallation/v2, argo-cd/v2) release versions that depend on jwt/v5. At that point, those upstream dependencies should be updated first, and go mod tidy will naturally handle the jwt module transition.

2. 🟡 Incomplete change — go.sum not updated

Severity: Medium · File: go.sum

The PR modifies go.mod but does not update go.sum. The go.sum file (lines 204–205) contains checksums only for golang-jwt/jwt/v4 v4.5.2 and has no entries for golang-jwt/jwt/v5. Even if the module path change were valid, builds would fail because Go enforces checksum verification and the new module's checksums are missing.

Remediation: Run go mod tidy to regenerate both go.mod and go.sum consistently. Note: running go mod tidy would almost certainly restore jwt/v4 because upstream dependencies still require it.

---

Summary

Severity	Count
High	1
Medium	1

The automated dependency bot does not correctly handle Go major version module path semantics (/v4 → /v5 is a module path change, not a version bump). This PR will break the build and should be closed until upstream transitive dependencies migrate to jwt/v5.

Previous run (4)

Review

Findings

Critical

• [logic error] go.mod:78 — The PR replaces github.com/golang-jwt/jwt/v4 with github.com/golang-jwt/jwt/v5, but in Go modules v4 and v5 are entirely different module paths. The transitive dependency github.com/bradleyfalzon/ghinstallation/v2 v2.17.0 (line 38) imports jwt/v4, not jwt/v5. Replacing the v4 line with v5 will not satisfy the v4 import requirement. Either go mod tidy will re-add the v4 line (making this change a no-op), or the build will fail because the v4 module is no longer declared.
  Remediation: Do not manually swap the jwt/v4 line to jwt/v5. If the goal is to remove jwt/v4, first update bradleyfalzon/ghinstallation/v2 (and any other transitive consumers) to a version that imports jwt/v5, then run go mod tidy to let Go resolve the dependency graph correctly.

High

• [incomplete change] go.mod:78 — The PR modifies go.mod but does not update go.sum. The go.sum file still contains only golang-jwt/jwt/v4 checksums and has no entries for golang-jwt/jwt/v5. A valid Go dependency update must include corresponding go.sum changes; without them the module verification will fail or go mod tidy will produce a different go.sum than what is committed.
  Remediation: Run go mod tidy after making the correct go.mod changes and commit the resulting go.sum updates.

Low

• [architectural-impact] go.mod:78 — The update from golang-jwt/jwt v4 to v5 represents a major version bump. While this is an indirect dependency not directly imported by this project, the concrete risk is that transitive consumers (such as ghinstallation) may not yet support jwt/v5.

Previous run (5)

Review

Findings

Critical

• [api-contract] go.mod:78 — This PR changes the go.mod entry from github.com/golang-jwt/jwt/v4 v4.5.2 to github.com/golang-jwt/jwt/v5 v5.3.1. In Go modules, v4 and v5 are distinct module paths due to semantic import versioning. Simply editing the version string in go.mod is not valid: (1) the go.sum file is not updated (it still references jwt/v4 checksums, with no jwt/v5 entries), so go mod verify and builds will fail; (2) jwt/v4 is an indirect dependency, meaning upstream modules (e.g., ghinstallation/v2, argoproj/argo-cd/v2) import it by path github.com/golang-jwt/jwt/v4 in their source code — you cannot override that to v5 from the downstream go.mod without those upstream libraries themselves releasing versions that import jwt/v5. This change will break the build.
  Remediation: Either (a) revert this change, since you cannot force indirect transitive dependencies to a different major version module path; or (b) update all direct dependencies (ghinstallation/v2, argo-cd/v2, etc.) to versions that themselves depend on jwt/v5, then run go mod tidy to let the resolver produce a consistent go.mod and go.sum.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:14 PM UTC · Completed 10:22 PM UTC
Commit: 01f864b · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:51 AM UTC · Completed 1:58 AM UTC
Commit: 58b0710 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:25 PM UTC · Completed 3:30 PM UTC
Commit: 58b0710 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:29 AM UTC · Completed 1:34 AM UTC
Commit: 58b0710 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:22 PM UTC · Completed 9:28 PM UTC
Commit: 58b0710 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[high] correctness

Missing go.sum update: PR modifies go.mod to reference jwt/v5 but go.sum still only contains checksums for jwt/v4. Builds, tests, and linting all fail because the Go toolchain cannot verify module integrity without the correct checksums.

Suggested fix: Run go mod tidy after the go.mod change to regenerate go.sum with the correct checksums for jwt/v5.

[fullsend-ai-review]

[high] correctness

Go major version module path incompatibility: jwt/v4 and jwt/v5 are distinct Go modules with different import paths. Manually swapping the go.mod entry does not update the dependency graph. If any transitive dependency still imports jwt/v4, removing it from go.mod breaks dependency resolution.

Suggested fix: Use go get github.com/golang-jwt/jwt/v5@v5.3.1 followed by go mod tidy to let Go resolve the full dependency graph, then commit both go.mod and go.sum.

[fullsend-ai-review]

[medium] intent-coherence

Automated dependency bot (Renovate/MintMaker) treats Go major version bump (v4→v5) as a simple version update, but Go module semantics require module path changes for major versions. The bot should be configured to run go mod tidy after go.mod changes or skip cross-major-version updates for Go modules.

Suggested fix: Configure MintMaker/Renovate postUpdateOptions to include gomodTidy, or add golang-jwt/jwt to the ignoreDeps list for major version updates.